8

I would like to know if there's a way to ask the local user (logged in via GUI) to confirm/deny any other authentication attempts, such as someone trying to log in via SSH?

The scenario is this, I may want to leave my SSH key on an user's machine to be able to debug or help them should things go wrong, but at the same time I want them to remain in control, so neither I nor someone having stolen my SSH key would be able to log in without at least a confirmation from the user (the user would expect me to tell them beforehand that I would log in, so if that didn't happen they reject the connection).

Is this possible? The machine in question is running Ubuntu 16.10, with the default Unity desktop environment.

Improve this question
1
  • Look at the manpage of sshd, regarding SSHRC. Maybe this could be a way to go. Commented Mar 9, 2017 at 16:32

2 Answers 2

Reset to default
1

Yes. That should be possible using custom PAM module in /etc/pam.d/sshd that would issue the prompt for the user using for example Zenity. But this QA is not a format to write you a whole script.

Improve this answer
2
  • Sure, I'm definitely not asking for someone to write an entire module, I was just wondering if there is an easier way or if it's been done already. Commented Mar 9, 2017 at 14:40
  • The basic idea what is needed is in the answer and if something similar already exists, it would be more appropriate in the software recommendations. Commented Mar 9, 2017 at 14:41
0

This is silly request but one could use a command pointing to a shell wrapper which would check for example for presence of a file, if the file is existing on the server than the session would not be end with 'exit' and allow shell with specified SSH_ORIGINAL_COMMAND.

But anyway... one can create two user accounts with same UID but different username. Thus for real user everything would work as usual, for a supporting guy, he would have /sbin/nologin as his default shell on the remote machine. If a support guy needs to login, remote machine administrator would change his shell to eg. bash and the session would work. Then the administrator can kick out the supporting guy and change his shell back to /sbin/nologin.

Improve this answer
1
  • Both accounts with same UID could use different ssh keys of course. And only local account could use for example sudo to run chsh. Commented Feb 5, 2019 at 23:49

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.